CVE-2026-8878: Securly Chrome Extension 3.0.7 Exposes Password Hashes via Weak Encryption

Technical summary

CVE-2026-8878 identifies multiple unauthenticated endpoints in Securly Chrome Extension 3.0.7 that expose SHA-1 hashes inadequately protected by Caesar cipher obfuscation. The vulnerability maps to CWE-326 (Inadequate Encryption Strength), reflecting the use of a cryptographically broken cipher for sensitive data. The network-based attack vector (CVSS AV:N), zero privilege requirement (PR:N), and no user interaction needed (UI:N) means any remote, unauthenticated attacker can exploit this with basic HTTP requests. The impact is high confidentiality loss (C:H) without integrity or availability impact. The CVSS 3.1 score of 7.5 reflects the straightforward exploitability and direct exposure of authentication-related data.

Business impact

Organizations using Securly Chrome Extension 3.0.7 face direct exposure of credential material. SHA-1 hashes, even if salted, can be subjected to precomputation attacks and rainbow table lookups, especially for common passwords. The trivial reversibility of Caesar cipher obfuscation means defenders cannot rely on any meaningful security layer. Affected users may experience credential compromise, unauthorized access to accounts, or lateral movement by attackers who obtain these hashes. For enterprises managing Securly deployments, this creates liability around user data protection and potential breach notification obligations.

Affected systems

Securly Chrome Extension version 3.0.7 is the confirmed affected release. Users running this specific version on any system with the Chrome browser are at risk. Organizations that have deployed Securly as a content filtering or security monitoring solution across managed Chrome instances should identify and audit all systems running 3.0.7. Other versions of the Securly extension and other Securly products should be evaluated separately; however, the scope of this CVE is specific to the Chrome Extension at 3.0.7.

Exploitability

Exploitation is trivial. An attacker requires only network access and basic knowledge of HTTP requests; no authentication, special tools, or user interaction is needed. Discovering the vulnerable endpoints may require reconnaissance, but the Caesar cipher obfuscation provides virtually no barrier once an endpoint is identified. An attacker can programmatically decrypt the hashes with minimal computational effort. The lack of authentication, rate limiting, or CORS restrictions (implied by the public accessibility) means this can be done at scale. This vulnerability is straightforward to exploit without any sophisticated techniques.

Remediation

Securly should issue an immediate patch to version 3.0.7 that restricts access to sensitive endpoints via proper authentication and authorization controls, removes or strengthens hash obfuscation with industry-standard encryption (AES-256 or equivalent), and implements rate limiting and monitoring. Users must upgrade to a patched version as soon as it becomes available. Interim mitigations include restricting network access to the Chrome Extension's backend endpoints via firewall rules or proxy policies if the deployment architecture allows it, and monitoring for suspicious access patterns to known sensitive endpoints.

Patch guidance

Monitor Securly's official security advisories and release notes for version updates following 3.0.7. Patches should be tested in a limited environment before full deployment to ensure compatibility with existing security policies and user workflows. Once a patched version is released, prioritize deployment to all affected systems. Verify against the vendor advisory that the patch addresses both the endpoint authentication issue and the weak obfuscation mechanism. Automated deployment via Chrome policy (chrome://policy) or mobile device management (MDM) solutions can accelerate rollout in enterprise environments.

Detection guidance

Audit systems running the Securly Chrome Extension to identify instances of version 3.0.7. Sensitive data exposure detection should focus on outbound HTTP requests from Chrome processes to Securly backend endpoints, particularly those returning SHA-1 hashes or other credential material. Monitor network traffic for unusual patterns of requests to known vulnerable endpoints. Log aggregation and SIEM tools can flag repeated or high-volume requests to these endpoints from a single user or system. Additionally, check for indicators such as base64-encoded or Caesar cipher–obfuscated data in transit. Organizations with DLP (Data Loss Prevention) tools should configure rules to flag exfiltration of hash values matching SHA-1 format.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), straightforward network exploitability, and direct exposure of credential material. The absence of complexity or authentication barriers means the barrier to exploitation is extremely low, and the impact—potential account compromise—is severe. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the ease of exploitation and sensitivity of exposed data suggest rapid weaponization is likely. Organizations should treat this as a critical priority requiring urgent patching.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, resulting in high confidentiality impact. The score does not account for attack complexity or scope broadening, meaning it represents a realistic, commonly exploitable scenario. The underlying issue—weak encryption of sensitive data—is conceptually simple but consequential. The score appropriately captures that while integrity and availability are not directly impacted, the confidentiality breach of hashes poses significant downstream risk to user accounts and organizational security posture.

Frequently asked questions